Roland Dreier b0d95e686f RDMA/ucma: Introduce safer rdma_addr_size() variants ... commit 84652aefb3 upstream. There are several places in the ucma ABI where userspace can pass in a sockaddr but set the address family to AF_IB. When that happens, rdma_addr_size() will return a size bigger than sizeof struct sockaddr_in6, and the ucma kernel code might end up copying past the end of a buffer not sized for a struct sockaddr_ib. Fix this by introducing new variants int rdma_addr_size_in6(struct sockaddr_in6 *addr); int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr); that are type-safe for the types used in the ucma ABI and return 0 if the size computed is bigger than the size of the type passed in. We can use these new variants to check what size userspace has passed in before copying any addresses. Reported-by: <syzbot+6800425d54ed3ed8135d@syzkaller.appspotmail.com> Signed-off-by: Roland Dreier <roland@purestorage.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-04-08 14:26:29 +02:00
..
core	RDMA/ucma: Introduce safer rdma_addr_size() variants	2018-04-08 14:26:29 +02:00
hw	RDMA/mlx5: Fix crash while accessing garbage pointer and freed memory	2018-03-28 18:24:33 +02:00
sw	RDMAVT: Fix synchronization around percpu_ref	2018-03-21 12:06:44 +01:00
ulp	iser-target: avoid reinitializing rdma contexts for isert commands	2018-03-24 11:01:25 +01:00
Kconfig	IB/core: Expose ioctl interface through experimental Kconfig	2017-08-31 08:35:14 -04:00
Makefile	IB/rdmavt: Create module framework and handle driver registration	2016-03-10 20:37:04 -05:00